azurerm_monitor_activity_log_alert.criteria.status doesn't support multiple selection

[sandy-wang]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

To be able to configure the selection of multiple status is important so we are not getting email scam for one activity 3 times (Accepted, Started and Succeeded/Failed).

Terraform Version

1.3.7

AzureRM Provider Version

3.45.0

Affected Resource(s)/Data Source(s)

azurerm_monitor_activity_log_alert

Terraform Configuration Files

resource "azurerm_monitor_activity_log_alert" "Create_or_Update_Application_Gateway" {
  enabled             = true
  name                = "PROD Azure Resources - Create or Update Application Gateway"
  resource_group_name = azurerm_resource_group.rg-common-prod.name
  scopes              = [
      "/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxx",
  ]

  action {
    action_group_id    = azurerm_monitor_action_group.INFRA-EMAIL-ALERT.id
    webhook_properties = {}
  }

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Network/applicationGateways/write"
    status         = "Failed, Succeeded"
  }
}

Debug Output/Panic Output

The apply went successful, but the alert wasn't configured as expected. Screenshots attached.

Expected Behaviour

No response

Actual Behaviour

Azure alert on Activity Log support selection of multiple status:

We have a need to not alert on Started status to reduce the amount of notification emails, so I followed the documentation to set the status in Terraform code. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_activity_log_alert#status

    criteria {
        category       = "Administrative"
        operation_name = "Microsoft.Network/applicationGateways/write"
        status         = "Failed, Succeeded"
    }

After applying it, I then verified on Azure Portal.

On the overview it looked correct to what's configured in code.
But when I edit the alert, it showed 0 selected (first screenshot above).

I then looked further on the JSON definition, also comparing to when I manually selected those 2 status.
Terraform:

[
    {
        "field": "category",
        "equals": "Administrative"
    },
    {
        "field": "operationName",
        "equals": "Microsoft.Network/applicationGateways/write"
    },
    {
        "field": "status",
        "equals": "Failed, Succeeded"
    }
]

Manual selection:

[
    {
        "field": "category",
        "equals": "Administrative"
    },
    {
        "field": "operationName",
        "equals": "Microsoft.Network/applicationGateways/write"
    },
    {
        "field": "status",
        "containsAny": [
            "failed",
            "succeeded"
        ]
    }
]

After noticing the difference, I thought I could set the status to an array but when I ran terraform plan, I got error:

on az_activity_log_alert.tf line 1085, in resource "azurerm_monitor_activity_log_alert" "Create_or_Update_Application_Gateway":
    1085:     status         = [
    1086:       "Failed",
    1087:       "Succeeded",
    1088:     ]
  
    Inappropriate value for attribute "status": string required.
  
    Error: Incorrect attribute value type

I also tried importing the resource I manually created with 2 status selected, but it then showed no status configured:

criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Network/applicationGateways/write"
  }

Overall, there is no way to specify mulitple status for activity log alert using terraform.

Steps to Reproduce

No response

Important Factoids

No response

References

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_activity_log_alert#status

[sandy-wang]

Hi, any update on this issue?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.